AN1254
Analytic 1254
Windows
Anomalous use of ICMP or UDP by non-network service processes for data exfiltration or remote control, especially if traffic bypasses proxy infrastructure or shows unusual flow patterns.
WinEventLog:Sysmon
EventCode=3, 22
NSM:Flow
ICMP/UDP traffic (Wireshark, Suricata, Zeek)
[ProcessContextAllowList]
Processes normally allowed to use ICMP/UDP (e.g., ping.exe, DNS resolver).
[ByteTransferAnomalyThreshold]
Suspicion if client sends much more data than it receives (e.g., >90%).
[ProtocolUsageBaseline]
Baseline which protocols are normal per host or segment (ICMP, UDP, etc.).
AN1255
Analytic 1255
Linux
ICMP or raw socket traffic generated by user-mode processes like bash, Python, or nc, typically using `ping`, `hping3`, or crafted packets via libpcap or scapy.
auditd:SYSCALL
sendto/connect
NSM:Flow
icmp.log, weird.log
[RawSocketExecutionPath]
Uncommon programs using raw sockets (e.g., netcat, Python, nmap).
[TimeWindow]
Tunable window for correlating execution with network events (e.g., 2m).
AN1256
Analytic 1256
macOS
Unsigned binaries or interpreted scripts initiating non-standard protocols (ICMP, UDP, SOCKS) outside of baseline network behavior.
macos:unifiedlog
com.apple.network
NSM:Flow
ICMP/UDP monitoring (tcpdump, Wireshark, Zeek)
[UnsignedBinaryNetworkUsage]
Detection threshold for unsigned or transient binaries making ICMP/UDP calls.
AN1257
Analytic 1257
ESXi
VMCI (Virtual Machine Communication Interface) traffic between guest and host, or between VMs, originating from non-management tools or unauthorized binaries.
esxi:vmkernel
VMCI syslog entries
[VMCIBackdoorProcess]
Monitor for non-vSphere or VMware-native processes using VMCI.
[GuestToHostCommPattern]
Baseline pattern of guest-to-host traffic vs anomaly (unexpected port, volume).
AN1258
Analytic 1258
Network Devices
Non-standard port/protocol pairings or low-entropy ICMP traffic resembling tunneling patterns (e.g., fixed-size pings with delays).
NSM:Firewall
ICMP/UDP protocol anomaly
NSM:Flow
conn.log, icmp.log
[ProtocolEntropyThreshold]
ICMP/UDP packet content entropy filter to identify encoded payloads.
[SessionDurationThreshold]
Long ICMP/UDP sessions beyond expected limits (e.g., >5min).